Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    21/04/2024, 09:14

General

  • Target

    fef2e82bba8f08e08179768d6905b0e8_JaffaCakes118.exe

  • Size

    413KB

  • MD5

    fef2e82bba8f08e08179768d6905b0e8

  • SHA1

    bc24ce23ec38eb2101b09f0392764bd0491a7e9e

  • SHA256

    9dcb7b7cf729304950f59cf82ad9e46da0387b2c617c44d5a42b2175cc1f3855

  • SHA512

    4a3dad079f3908c0988f4014211932dab39e160863e5cc7c588b39cbaf9d73a8125c66ab57114527808e0af1c6852675fe1194fb893b587277925870e88840ab

  • SSDEEP

    12288:zP6ys+NgzZhkDjhMcrL4NSsQifn/9043tTHVZs4f5f:HBNUfkGcYNSK10YtTvs4Bf

Score
10/10

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 2 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Drops file in Drivers directory 2 IoCs
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Modifies Internet Explorer start page 1 TTPs 2 IoCs
  • Modifies registry class 53 IoCs
  • Runs .reg file with regedit 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fef2e82bba8f08e08179768d6905b0e8_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\fef2e82bba8f08e08179768d6905b0e8_JaffaCakes118.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Drops file in Drivers directory
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3040
    • C:\Windows\SysWOW64\regedit.exe
      C:\Windows\regedit.exe /S C:\Windows\system32\msscp.reg
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Runs .reg file with regedit
      PID:2108
    • C:\Users\Admin\AppData\Local\Temp\fef2e82bba8f08e08179768d6905b0e8_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\fef2e82bba8f08e08179768d6905b0e8_JaffaCakes118.exe
      2⤵
      • Drops file in Drivers directory
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2128
      • C:\Windows\SysWOW64\regedit.exe
        C:\Windows\regedit.exe /S C:\Windows\system32\msscp.reg
        3⤵
        • Modifies visibility of file extensions in Explorer
        • Runs .reg file with regedit
        PID:1196

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Common Files\System\taobao.ico

    Filesize

    14KB

    MD5

    468fada123f5548ac87e57bae81f6782

    SHA1

    edb8f012c25906e6afd8bf335b495e16c440243d

    SHA256

    091c882bb307d57f2c7c42309e7ba8740130fef8c3ed772b0bc5e5505e37034d

    SHA512

    635ec26c88c2394dd4f2a81b9aea8f429a91adfeb37ae34e51b03f3cf8e503c123c3685938f40cea07d6146e0c7113aadbe62fa528f1f6d8b995e617fd68a4aa

  • C:\WINDOWS\system32\drivers\etc\hosts

    Filesize

    3KB

    MD5

    985f40da438a9d87bebf7b90027d82a8

    SHA1

    aa932ff777f4db93780f69472b248d2c099cd62a

    SHA256

    20db49adb3a686c48ac630475ee7cfb6c7dd8339fa9013096d5efaa00bd97643

    SHA512

    c8887aefd51e24c87ef301f24623cd5c53c062711252e64d83ab06ff7499a5ed474655105f14a540bbec54cf0488ccdc97d2bfd5bb3cd3e702b3d3ce756bf94c

  • C:\Windows\SysWOW64\msscp.reg

    Filesize

    339B

    MD5

    f95095dc3217ddbddf21c7284ba10f8b

    SHA1

    fd5201cf9aa7859b9d93ba8ffd6ba80db16eacae

    SHA256

    caa4e4cc7de0f55adade9132ed724c32197cdfb9df6021ff061a94ae57755ad3

    SHA512

    2eeb0e510f837dcd78fe72d0196dda581ab464bb10ba507348078ca00e10a51cb25ab40d29c8288ee2e0fbd61fa324b65200be1ced9ea7a565267ac73db967f6

  • memory/2128-8-0x0000000000400000-0x00000000004DD000-memory.dmp

    Filesize

    884KB

  • memory/2128-10-0x0000000000220000-0x0000000000221000-memory.dmp

    Filesize

    4KB

  • memory/2128-24-0x0000000000400000-0x00000000004DD000-memory.dmp

    Filesize

    884KB

  • memory/3040-0-0x0000000000400000-0x00000000004DD000-memory.dmp

    Filesize

    884KB

  • memory/3040-1-0x0000000000220000-0x0000000000221000-memory.dmp

    Filesize

    4KB

  • memory/3040-25-0x0000000000400000-0x00000000004DD000-memory.dmp

    Filesize

    884KB